Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set,
    List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or
    size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an
    uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to
    silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8. (CVE-2026-59879)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set,     List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or     size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an     uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to     silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8. (CVE-2026-59879)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
445102	SCA: security update for immutable (GHSA-v56q-mh7h-f735)	Tenable Cloud Security	SCA Checks	high
445102	SCA: security update for immutable (GHSA-v56q-mh7h-f735)	Tenable Self-Hosted Container Security	SCA Checks	high
328706	Linux Distros Unpatched Vulnerability : CVE-2026-59879	Nessus	Misc.	high

Detections

Analytics

CVE-2026-59879

high

Tenable Plugins

high

high

high